In this guide · 8 sections
Short answer
Personal WhatsApp for work means customer data and relationships leave with the employee, and you can't secure or delete it. Move customer chats to a business-owned number: the WhatsApp Business app with linked devices for small teams, or the WhatsApp Business Platform for larger ones.
Why personal WhatsApp for work is a problem
The issue isn't WhatsApp itself, which encrypts messages in transit. It's that the account, the phone and the chat history belong to the employee, not the business.
| Risk | What happens in practice |
|---|---|
| Customer relationships leave | A salesperson resigns and keeps every customer chat and number on their phone |
| No access to records | You can't see what was promised, quoted or agreed when a dispute comes up |
| Personal data you can't control | NRIC photos, addresses and payment screenshots sit in personal chats and backups |
| No way to delete on exit | You can't wipe a personal WhatsApp account when someone leaves |
| Lost or stolen phone | Customer data is exposed if the phone isn't locked or encrypted |
| Account takeover | A hijacked personal WhatsApp can be used to scam your customers in your name |
Customers also stop reaching you if a number changes hands. When the employee's number is the only contact they have, the business loses the lead entirely.
What the PDPA expects from you
Under section 24 of the PDPA, an organisation must protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, use, disclosure and similar risks, and the loss of any storage medium or device on which personal data is stored.
Customer details your staff collect for work are under your control, even when they sit in a personal WhatsApp. If a phone is lost or a former employee misuses a customer list, you may have to show what security arrangements you had. "We trusted them" is weak; a business number, device rules and an exit process are much stronger.
Better setups compared
There are three realistic options, depending on team size and message volume.
WhatsApp Business app, shared number
Small teams- One business-owned number on a company phone
- Up to four linked devices (phones, desktop, web)
- Name each device and see which device sent a message
- Free app; no per-agent logins
Best for: Two to five staff sharing customer chats.
WhatsApp Business app with multi-agent
- Up to 10 linked devices with a Meta Verified or Meta One subscription
- Assign chats to agents
- See which agent or device sent each message
- Paid subscription; may not be available to every account yet
Best for: Growing teams that want to stay on the app.
WhatsApp Business Platform (API)
Larger teams- Number managed through an official provider
- Shared inbox with individual logins per staff member
- Templates, automation and integrations with your CRM or booking system
- Per-message fees and provider subscription
Best for: Teams over five agents, or with automated notifications.
Sources: WhatsApp Help Center pages on multi-agent and linked devices. If you're deciding between WhatsApp and other team chat tools for internal use, see our WhatsApp vs Slack vs Teams comparison.
Setting up one business number on linked devices
For most small teams, the WhatsApp Business app on a company-owned phone, with staff on linked devices, fixes the main problem at no cost.
Get a number the business owns
Use a company mobile line, not a staff member's personal number. Keep the SIM in a company phone kept at the office or with the owner.
Install WhatsApp Business on that phone
Set up the business profile with your business name, hours and address. Turn on two-step verification with a PIN only the owner knows.
Link staff devices
From the primary phone, link up to four devices, such as office PCs through WhatsApp Web or desktop, or staff phones. Name each device after the person using it.
Keep the primary phone active
WhatsApp says you must log in on the primary phone every 14 days to keep linked devices connected. Put it in someone's weekly routine.
Review linked devices monthly
Check the linked devices list on the primary phone and log out anything you don't recognise or that belongs to someone who has left.
Without multi-agent, everyone sees every chat and there's no per-person login, so it suits teams who trust each other with all customer conversations.
If staff must use their own phones
Sometimes staff need the business WhatsApp on their personal phone. Reduce the risk:
- Use a linked device on the business number, not the staff member's personal WhatsApp account.
- On Android, consider a work profile through mobile device management, which keeps work apps separate and can be removed without touching personal data. Our BYOD and MDM guide explains how.
- Require a screen lock, device encryption and up-to-date software on any phone used for work.
- Turn off automatic saving of customer media to the phone's gallery where possible.
- On exit, log the device out from the primary phone's linked devices list on the employee's last day.
A WhatsApp policy line you can adopt
Write the rule down and have staff acknowledge it. A short version:
WhatsApp for work: staff rules
Do it yourself or get help?
Moving a small team to one business number with linked devices is a half-day job for the owner. The bigger projects are moving to the WhatsApp Business Platform with a shared inbox, or putting staff phones under device management.
Our WhatsApp Notifications (S$590) sets up a WhatsApp Business API number through an official provider, with up to 3 message templates, triggers from your store, form or booking system and opt-in handling for PDPA. For phones, Device Encryption & Management (S$490) enrols up to 10 devices in Microsoft Intune or Google endpoint management, with work profiles for personal phones and remote lock and wipe tested. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront and brief us in writing.
Frequently asked questions
It isn't banned, but it makes PDPA compliance harder. Section 24 of the PDPA requires your business to make reasonable security arrangements for personal data under its control, including on devices. Customer data in staff's personal WhatsApp accounts is hard to secure, review or delete, especially when someone leaves. A business-owned number is the safer setup.
The WhatsApp Business app lets one primary phone link up to four devices, such as phones, the desktop app or WhatsApp Web. WhatsApp's multi-agent feature, available with a Meta Verified or Meta One subscription, allows up to 10 linked devices and chat assignment. For larger teams, the WhatsApp Business Platform through a provider supports a shared inbox with individual logins.
WhatsApp says you need to log in on the primary phone at least every 14 days to keep linked devices connected. If the company phone holding the business number sits unused in a drawer, linked devices can disconnect. Make checking the primary phone part of someone's weekly routine.
If they used a linked device on the business number, log that device out from the primary phone on their last day and collect any company phone. If they used their personal WhatsApp, ask them to hand over relevant customer chats and contacts and delete customer data, and record that request. Then move customers to the business number.
Not their personal WhatsApp account. With mobile device management and an Android work profile, you can remove work apps and data in the work profile without touching personal data, but only if the phone was enrolled beforehand. That's why keeping customer chats on a business number from the start matters.